1. Field of the Invention
The present invention relates to a fail-safe circuit for a control system, and particularly relates to the fail-safe circuit for the control system which reliably backs up a main control circuit of the system by taking over control operations when the main control circuit fails.
2. Description of the Prior Art
Conventional fail-safe circuits are exemplified by Japanese Patent Applications Unexamined Open No. Sho. 48-3351 and No. Sho. 53-54441.
FIG. 1 shows an example of such a conventional fail-safe circuit for a control system. In FIG. 1, a main control circuit 1 includes a microcomputer and outputs a control signal b' to a switching circuit 20 and a status signal a' indicative of the status of the main control circuit 1 to a back-up circuit 10. The status signal a' has a predetermined frequency realized by periodically inverting an output port by means of the main control circuit 1 in accordance with a program. Hence, if the main control circuit fails, the status signal a' will remain in one state for an excessively long time.
The above-described back-up circuit 10 constitutes an auxiliary control circuit and serves as a fail-safe circuit which detects failure of the main control circuit 1 reflected in the status signal a' and produces a signal c' as a substitute for the control signal b' as well as a switching signal e'. The switching signal e' is sent to the switching circuit 20 which outputs a control signal d' to a controlled device, the control signal d' being selected from either the control signal b' or back-up signal c' depending on the status of the switching signal e'. Furthermore, a reset circuit 30 produces a reset signal f for resetting the main control circuit 1 when the status signal a' described above indicates failure of the main control circuit.
However, there is a drawback in the system described above in that since a single switching signal e' from the back-up circuit 10 enables switching between the control signal b' from the main control circuit 1 and back-up signal c' from the back-up circuit 10 to select as the control output d', the back-up circuit 10 may produce a faulty switching signal e' in spite of the normal operatin of the main control circuit 1, leading to the danger of an erroneous or abnormal back-up signal c' being used as the control output d'.
In this way, the back-up circuit which is intended to function merely as a fail-safe circuit for the main control circuit may disturb the control output due to its own failure. This degrades significantly the reliability of the whole control system.